ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: AF028.001
  • Created: 06th October 2025
  • Updated: 08th October 2025
  • Contributor: The ITM Team

Authorized Leave

The subject deliberately leverages formally approved leave, such as annual vacation, sick leave, or medically certified absence, to delay or frustrate investigative procedures. This tactic may be employed after becoming aware of organizational suspicion, active inquiry, or impending enforcement action. By taking sanctioned time off, the subject restricts opportunities for time-sensitive interviews, effectively obstructing the pace of investigation without violating leave policy.